ambera@1.0.0

Analysis

ambera@1.0.0 is a trojanized SVG utility package that exports benign helper functions (isSvg, getSvgSize, etc.) alongside a hidden getPlugin() function. When called, getPlugin() makes an HTTPS request to api[.]avax-test[.]dev/ext/bc/C/rpc and passes the response body to new Function('require', data)(require), executing arbitrary remote code in the Node.js process with full require access. The attacker controls the remote endpoint and can serve any malicious payload at any time. The package description claims to be zero-dependency but depends on the deprecated 'request' package.